Skip to content
Help Center Back to AgenticObjects

Row-level security

Limit which rows of a data model a person can see — define a rule on a dimension, then bind people to values picked from the data source.

Console 6 min read Updated

Row-level security decides which slice of a data model each person can see. A regional manager sees their region, a store lead sees their store, and every answer an agent gives them is computed only from those rows. You set it up once per data model, and it applies the moment you save.

What this screen is for

Roles decide which agents and screens a person can use. Row-level security goes one level deeper: it decides which rows of the data behind those agents they can read. It has two parts:

  • A rule on one dimension of the model — for example Region or Store.
  • A binding that ties a person to one or more values of that dimension — for example North and West.

You never write filter logic. You pick a dimension; the product builds the condition itself from that dimension's key column and adds it to every query sent to the data source.

Each data model has its own rules. Open a model from Data models and press Row security in its header.

What you see

  1. Header — a link back to the model, and a line saying what you save applies to every query the engine runs.
  2. Summary — the number of rules, restricted users, users with ALL, and users not bound on every rule.
  3. Mode banner — Transition or Enforced (see below). During the transition the banner carries Turn enforcement on.
  4. Not bound on every rule — the people who still need a binding, with the rules they need: Give ALL (only for a holder of the Give ALL row access permission) or Choose values.
  5. How it works — what a rule, a binding, several values, several rules and ALL mean; whose restriction a scheduled run uses; what an unbound person sees in this model's mode.
  6. Rules tab — a card per rule: the dimension, the condition the engine applies, Edit (name and description), Archive, the bound people and the values they see, and for each person Edit values and Remove binding. Bind a user sits under the card. The Add rule form is at the end of the page.
  7. By user tab — each row a person, each column a rule: the values the person sees under that rule, ALL, or what an unbound cell means here (unbound — nothing, or during the transition unbound — every value), and the result.

How to …

Create a rule

  1. Under Add rule, type a Name people will recognise, for example Store managers.
  2. Choose the Dimension the rule restricts. The condition the engine will apply shows below.
  3. Optionally add a Description, then press Add rule.

Restrict a person to specific values

  1. On the rule's card, press Bind a user.
  2. In 1. User, search for the person by name or email and pick them. If they are already bound, their current values arrive ticked.
  3. The 2. Values they may see list holds the dimension's distinct values from the data source, shown with their names and keys. Type to search, and tick the values you want. When there are many, the first 1000 are shown and the search runs in the data source.
  4. The Save button shows how many values you picked; press it. The person now appears on the card with sees only and their values.

Give a person every value (ALL)

  1. ALL needs the Give ALL row access permission, which a company administrator grants on Users & Roles.
  2. On the rule's card, press Bind a user, pick the person and press Give ALL — or press Give ALL next to them in the Not bound on every rule list. Confirm.
  3. The person now sees every value of that rule's dimension, including values added to the data later. ALL is given per rule: a model with two rules needs a binding on both. Every ALL given or taken away is recorded in the Audit log.

End the transition

  1. A model starts in Transition when its first rule is added (and models that already had rules before strict row-level security arrived started there too): a person not bound on a rule still sees every value of it, and the answer says so.
  2. Work through Not bound on every rule: give each person ALL or Choose values.
  3. Press Turn enforcement on and confirm. If anyone is still unbound, the confirmation says how many people will see nothing. This cannot be turned back, and it is recorded in the audit log.
  4. Once enforcement is on, a new rule on a dimension no other rule covers takes effect at once: nobody is bound on that dimension yet, so everyone not bound on it would see nothing. Adding such a rule asks you to confirm first, naming the dimension and how many people it would lock out; the confirmed rule is recorded in the audit log. Bind the people on it (values or ALL) right after.

Change or lift a restriction

  1. To change a person's values, press Edit values, change the ticks and save.
  2. To take the person off this rule entirely, press Remove binding and confirm.
  3. To retire the whole rule, press Archive on its card and confirm. The rule and its bindings are archived and the restriction lifts.

How to read it

  • No binding means nothing. On an enforced model, a person bound to no value and no ALL on a rule sees nothing of the model: no chat answer (the chat says they have no row access yet), no scheduled run (its owner is told instead of receiving an empty briefing), no finding or briefing of its agents. Seeing everything is a decision: an ALL binding.
  • During the transition the old rule still applies: a person not bound on a rule sees every value of it, and the answer carries a sentence saying so.
  • ALL material needs ALL. A finding or briefing produced by an ALL owner is kept with its ALL scope and only people with ALL on that rule open it; on an enforced model, a finding produced before any restriction counts the same way.
  • Values come from the data source. The list is built by asking the source at that moment. If the source cannot be reached, the screen says it is showing only the sample values of the imported file and that the list may be incomplete.
  • Saving is checked. A value that is not among the file's samples is asked of the data source before it is saved; a value the source does not have is not saved, so a typo can never silently hide anyone's rows.
  • The red "no value — queries are refused" label marks a person bound to a rule without a value. The engine then stays on the safe side and refuses that person's queries; choose values or remove the binding.

Good to know

  • Saved rules and bindings apply from the next query; caches are kept per restriction, so nothing needs flushing.
  • In a scheduled run, the restriction of the agent's owner applies. If the owner has no binding on an enforced model, the run does not start and the owner (or, failing that, the company administrators) is notified.
  • Only people whose role reaches the model's workspace can be bound. If someone does not appear in the search, give them a role on Users & Roles first.
  • Archiving a rule keeps its full history. Nothing is deleted.